the best means to respond to it, and of how much to spend on security. In Russia, major nuclear material facilities are generally under heavy armed guard, but techniques for detailed accounting of the material have received less emphasis, in part because during the Soviet era, the most likely threat was long seen as an outside attack rather than an insider diversion. In Japan, by contrast, since the government believes that the unity of Japanese society makes outside attack unlikely, the guards at plutonium stores and other nuclear facilities do not carry firearms. But the technologies in place in Japan for safeguards and material accounting are some of the best in the world.36
Unfortunately, as with all human endeavors, the effectiveness of physical security systems is often considerably less in practice than it is on paper. For example, even in the U.S. nuclear weapons complex, probably among the most secure facilities in the world, tests held as recently as the mid-1980s determined that plausible terrorist attacks could succeed in stealing significant quantities of plutonium, or even bomb components. A large-scale effort was then launched to identify weaknesses in the system and make corrections.37
Safeguards and security for plutonium in spent fuel are less stringent than those for separated plutonium and HEU. In general, it is assumed that the intense radioactivity of spent fuel, and the size and weight of spent fuel bundles or casks, would reduce the risk of theft to almost zero. Since states with significant nuclear programs generally have spent fuel on their territories, only states without significant nuclear programs or subnational groups would pose plausible threats to steal spent fuel. Neither the Convention on the Physical Protection of Nuclear Materials nor IAEA recommendations require much more for such materials than placing them within a fenced area to which access is controlled.
In most countries, spent fuel is initially stored in water-filled ponds at reactor sites. The security applied to this fuel is often simply the same security applied to protect the reactor itself from sabotage.38 At many sites, these ponds are nearing their capacity, and a number of countries are therefore considering
guarded area around the vault (known as the "inner area") would be surrounded by a larger area somewhat less carefully controlled, known as the "protected area." Fences or similar barriers would surround both areas, and guards would be in communication with forces that could respond to an attempt to attack the facility.
36 Useful descriptions of physical security philosophies in a number of countries, including Japan, can be found in a special issue of the Journal of Nuclear Materials Management, January 1988. For a description of the Russian approach, see Oleg Bukharin, The Threat of Nuclear Terrorism and the Physical Security of Nuclear Installations and Materials in the Former Soviet Union (Monterey, Calif.: Center for Russian and Eurasian Studies, Monterey Institute of International Studies, Occasional Paper No. 2, August 1992).
37 House of Representatives, Energy and Commerce Subcommittee on Oversight and Investigations, Adequacy of Safeguards and Security at Department of Energy Nuclear Weapons Production Facilities, March 6,1986. See also National Research Council, Material Conti'ol and Accounting in the Department of Energy's Nuclear Fuel Complex (Washington, D.C.: National Academy Press, 1989), pp. 29-31.
38 In the United States, for example, the "design basis threat" against which security systems for reactors and spent fuel ponds are designed includes the possibility of an armed attack by a small group of well-trained anderification Technology Information Center, 1992); and Marvin Miller, "Are IAEA Safeguards on Plutonium Bulk-Handling Facilities Effective?" Nuclear Control Institute, August 1990. For a summary of the
